Terraform-provider-azuredevops: Provider can only lookup 25 key vault items when adding variables to a linked variable group

[booyaa]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Terraform v0.15.3
on linux_amd64
+ provider registry.terraform.io/hashicorp/azurerm v2.58.0
+ provider registry.terraform.io/microsoft/azuredevops v0.1.4

Affected Resource(s)

• azuredevops_variable_group

Terraform Configuration Files

# assumes you have an existing service connection to azure in devops
variable "azuredevops_serviceendpoint_azurerm_endpointazure_id" {
  type    = string
  default = "__CHANGE_ME__"
}

data "azuredevops_project" "project" {
  name = "__CHANGE_ME__"
}

# assumes you have a key vault setup with appropriate permissions, but no secrets set
data "azurerm_key_vault" "tester" {
  name = "__CHANGE_ME__"
  resource_group_name =  "__CHANGE_ME__"
}

locals {
  list_of_secrets = [ for i in range(30) : format("var%02d", I) ]

  # change test case range to 25 to demonstrate it working
  test_case = [ for i in range(26): local.list_of_secrets[i] ]
}

# creates 30 secrets
resource "azurerm_key_vault_secret" "multipass" {
  count = length(local.list_of_secrets)
  name         = local.list_of_secrets[count.index]
  value        = count.index
  key_vault_id = data.azurerm_key_vault.tester.id
}

resource "azuredevops_variable_group" "environment" {
  project_id   = data.azuredevops_project.project.id
  name         = "devops-bug"
  description  = "This variable group is maintained via Terraform and Key Vault"
  allow_access = true

  key_vault {
    name                = data.azurerm_key_vault.tester.name
    service_endpoint_id = var.azuredevops_serviceendpoint_azurerm_endpointazure_id
  }

  # creates a subset of variables from key vault
  dynamic "variable" {
    for_each = local.test_case
    iterator = item
    content {
      name = item.value
    }
  }
}

Debug Output

https://gist.github.com/booyaa/9ea7705f43a76e759a0436925145973a

Panic Output

n/a

Expected Behavior

Should create variables in the variable group that correspond to the key vault secrets: var00 .. var25

Actual Behavior

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"
azuredevops_variable_group.environment: Modifying... [id=41]
╷
│ Error: Expanding variable group resource data: Invalid Key Vault variables: ( var25 ) , can not find in Azure Key Vault: ( kv-sw-tester ) 
│ 
│   with azuredevops_variable_group.environment,
│   on main.tf line 55, in resource "azuredevops_variable_group" "environment":
│   55: resource "azuredevops_variable_group" "environment" {
│ 
╵

secrets do exist...

Click to expand az keyvault secret list output

az keyvault secret list --vault-name REDACTED --output table 
ContentType    Name
-------------  ------
               var00
               var01
               var02
               var03
               var04
               var05
               var06
               var07
               var08
               var09
               var10
               var11
               var12
               var13
               var14
               var15
               var16
               var17
               var18
               var19
               var20
               var21
               var22
               var23
               var24
               var25
               var26
               var27
               var28
               var29

Steps to Reproduce

1. terraform plan && terraform apply

Important Factoids

• using azure cli authorisation
• I've got owner access to the azure subscription and I'm full admin in DevOps.
• I'm listed in the key vault access policy with full access to key vault secrets (including purge)

References

• #0000

[xuzhang3]

Hi @booyaa Thanks for your feedback, this is a bug. The default secrets response page size is 25 and ADO provider only get the first page.

[jonathansp]

@xuzhang3 ideally it should paginate, but if we can have a small workaround for now, like increasing the pageSize to 100 on the API call would be good.

[liamrob]

ADO doesn't look like they expose an option to map to the maxresults query param in AzureRM apis based on the AzureKeyVaultSecrets datasource.

The Azure api returns a netxtlink prop containing a $skiptoken value, this gets passed back from ADO too so it looks like this needs to be used in the provider to build up the list of secrets using the AzureKeyVaultSecretsWithSkipToken datasource instead of the AzureKeyVaultSecrets